Eight days after the October 29 theft, roughly half of the stolen funds still sit in wallets linked to the attackers, mostly in ETH and Bitcoin. Elliptic says the $3.11B is very likely still held by North Korea, and only a negligible amount has been cashed out.

About $2.85B, or 44% of the haul, has been frozen or seized, mostly stablecoins blocked by Tether and Circle within an hour of the theft. After the $1.5B Bybit hack in February 2025, only about 3% was frozen.

The laundering is clearly automated: more than 20,000 wallets across 16 blockchains, at least 36 services and 65,000 transactions. About $124M has been converted into Bitcoin, largely via THORChain, while the 18,270 BTC taken from Binance has not moved since the day of the hack.

The FBI attributes the theft to North Korea's TraderTraitor group, which Pyongyang denies. The remaining ETH is expected to be swapped for Bitcoin and cashed out through OTC brokers over months. Binance aims to reopen withdrawals for all tokens on restored networks by the end of next week.